本機盜取U盤文件的流氓軟件設計

論文字數:8226,頁數:22

摘要：
 本文介紹了本機盜取U盤文件和為增強程序隱蔽性而采用的進程隱藏技術的原理解析，源代碼基于Win32的應用程序（Win32-based applications）編寫，VC 6.0環境下編譯通過。文章詳細敘述了操作系統如何將USB端口狀態改變通知系統中的運行進程，運行進程如何利用操作系統發送的消息判斷USB接口中有可移動存儲設備插入。作為關鍵部分，文章用較大篇幅介紹了本設計采用的利用API HOOK（掛接 SSDT）技術實現進程隱藏（基于Windows NT系統）原理和編程思想。作為日志記錄部分，本設計采用ODBC API + Microsoft Access數據庫實現。
關鍵詞：
 盜取U盤文件；進程隱藏；API HOOK ；掛接SSDT ；ODBC API；Microsoft Access
 

A malicious software design for stealing USB flash disk files based on local machine 

Abstract:
 This paper introduces stealing USB Flash Disk files in local machine, and the common process concealment technologies used in Windows-NT operating system environment. The source code for application was written based on Win32 (Win32-based applications) and compiled successfully in VC 6.0 environment. It describes, in detail, how the operating system send messages ,for the notification of USB port status changes ,to the running processes, the process which received messages how to judge a portable storage device is plugged. As key parts of design, the theory of API HOOK (hooking SSDT) technology for the hidden process (based on Windows NT operating systems) and programming ideas were introduced by large spaces. In log recording chapter, the design was implemented by ODBC API and Microsoft Access database.
Keywords:
  Win32-based applications; concealing running processes; API HOOK; hooking SSDT; ODBC API; Microsoft Access

目錄
1.簡介 - 1 -
2.關鍵原理和相應技術解析 - 1 -
2.1.識別U盤插入系統 - 1 -
2.1.1本小節理論和技術原理 - 1 -
2.1.2本小節部分源代碼示例 - 4 -
2.2.利用API HOOK技術實現進程隱藏 - 4 -
2.2.1進程隱藏技術綜論 - 4 -
2.2.2 API Hook、掛接SSDT以及內核驅動原理 - 4 -
2.2.3 Windows基本架構與掛接SSDT基本原理 - 5 -
2.2.4用戶模式和內核模式 - 7 -
2.2.5 Windows基本內存體系結構 - 7 -
2.2.6 利用API Hook掛接SSDT 實現進程隱藏的原理[8] - 8 -
2.3.利用Shell API實現文件復制簡述 - 9 -
2.3.1 Shell綜述 - 9 -
2.3.2 SHFileOperation()函數實現文件復制操作 - 9 -
2.3.3 為文件復制所做準備 - 10 -
2.4.日志記錄 - 11 -
2.4.1 ODBC簡介 - 11 -
2.4.2日記記錄模塊編程實現 - 12 -
3.測試運行結果 - 14 -
主要參考文獻： - 17 -
致謝 - 17 -